Daily Tech Digest by Kannan Subbiah: SDLC

Showing posts with label SDLC. Show all posts

Daily Tech Digest - May 05, 2026

Quote for the day:

“Our greatest fear should not be of failure … but of succeeding at things in life that don’t really matter.” -- Francis Chan

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 25 mins • Perfect for listening on the go.

The fake IT worker problem CISOs can’t ignore

The article "The fake IT worker problem CISOs can’t ignore" highlights a burgeoning cybersecurity threat where thousands of fraudulent IT professionals, often linked to state-sponsored actors like North Korea, infiltrate organizations by exploiting remote hiring vulnerabilities. These sophisticated adversaries utilize advanced artificial intelligence to craft fabricated resumes, generate convincing deepfake identities, and master scripted interviews, successfully bypassing traditional background checks that typically verify provided information rather than detecting outright fraud. Once integrated as trusted insiders, these malicious actors can facilitate data exfiltration, industrial sabotage, or the funneling of corporate funds to foreign governments. The piece underscores that this is no longer just a recruitment issue but a critical insider risk management challenge. CISOs are urged to implement more rigorous vetting processes, such as multi-stage panel interviews and project-based technical evaluations, to identify inconsistencies that automated screenings miss. Furthermore, the article advises organizations to adopt a "least privilege" approach for new hires, restricting access to sensitive systems until identities are definitively verified. Beyond immediate security breaches, the presence of fake workers creates substantial business and compliance risks, potentially leading to regulatory penalties and the erosion of client trust, making it imperative for leadership to coordinate across HR and security departments to mitigate this evolving threat.

Three Pillars of Platform Engineering: A Virtuous Cycle

In the article "Three Pillars of Platform Engineering: A Virtuous Cycle," Pratik Agarwal challenges the notion that reliability and ergonomics are opposing trade-offs, arguing instead that they form a mutually reinforcing feedback loop. The framework is built upon three foundational pillars: automated reliability, developer ergonomics, and operator ergonomics. The first pillar treats reliability as a managed state where a centralized "control plane" or "brain" continuously reconciles the system’s actual state with its desired state, automating complex tasks like shard rebalancing and self-healing. The second pillar, developer ergonomics, focuses on providing opinionated SDKs that enforce safe defaults—such as environment-aware configurations and sophisticated retry strategies—to prevent cascading failures and reduce cognitive load. Finally, operator ergonomics emphasizes building internal tools that encode tribal knowledge into automated commands and layered observability, allowing even novice engineers to resolve incidents effectively. Together, these pillars create a virtuous cycle where ergonomic interfaces produce predictable traffic patterns, which in turn stabilize the infrastructure and reduce the operational burden. This stability grants platform teams the bandwidth to further refine their tools, building a foundation of trust that allows organizational scaling without the friction of "sharp" interfaces or manual interventions.

Why Humans Are Still More Cost-Effective Than AI Compute

The article explores a significant study by MIT’s Computer Science and Artificial Intelligence Laboratory regarding the economic viability of AI compared to human labor. Despite intense hype surrounding automation, researchers discovered that for many visual tasks, humans remain far more cost-effective than computer vision systems. Specifically, the research indicates that only about twenty-three percent of worker wages currently spent on tasks involving visual inspection are economically attractive for AI replacement today. This financial gap is primarily due to the massive upfront costs associated with implementing, training, and maintaining sophisticated AI infrastructure. While AI performance is technically impressive, the capital investment required often yields a poor return on investment compared to versatile human workers who are already integrated into existing workflows. Furthermore, high energy consumption and specialized hardware needs contribute to the financial burden of AI compute. The study suggests that while AI capabilities will inevitably improve and costs may eventually decrease, there is no immediate "job apocalypse" for roles requiring visual discernment. Instead, human intelligence provides a level of flexibility and affordability that current technology cannot yet match at scale. Ultimately, the transition to AI-driven labor will be gradual, dictated more by cold economic feasibility than by pure technical capability.

Leading Without Forecasts: How CEOs Navigate Unpredictable Markets

In his May 2026 article for the Forbes Business Council, CEO Yerik Aubakirov argues that traditional long-term forecasting is no longer viable in a global landscape defined by rapid geopolitical, regulatory, and technological shifts. Aubakirov advocates for a fundamental change in leadership, suggesting that CEOs must replace rigid five-year plans with agile, hypothesis-driven strategies. Drawing a parallel to modern meteorology, he recommends layering broad seasonal outlooks with rolling monthly and quarterly updates to maintain operational relevance. A critical component of this adaptive approach involves rethinking capital allocation; instead of committing massive upfront investments to unproven initiatives, successful organizations now deploy capital in gradual tranches, scaling only when early signals confirm market viability. This staged investment model minimizes the risk of catastrophic failure while allowing for greater flexibility. Furthermore, the author emphasizes the importance of shortening internal decision cycles and cultivating a leadership team capable of operating decisively even with partial information. Ultimately, Aubakirov asserts that uncertainty is the new baseline for the 2020s. By treating strategic plans as fluid experiments rather than fixed commitments and diversifying strategic bets, modern leaders can ensure their organizations remain resilient, allowing their portfolios to "breathe" and evolve through market volatility rather than breaking under pressure.

Agentic AI is rewiring the SDLC

In the article "Agentic AI is rewiring the SDLC," Vipin Jain explores how autonomous agents are transforming software development from a procedural lifecycle into an intelligence-led delivery model. This shift moves AI beyond simple code suggestion to active participation across all stages, including planning, architecture, testing, and operations. In the planning phase, agents analyze existing codebases and refine user stories, though Jain warns that "vague intent" remains a primary bottleneck. Architecture evolves from static documentation to the definition of executable guardrails, making the role more operational and consequential. During the build and test phases, agents decompose tasks and generate reviewable work, shifting key productivity metrics from mere code volume to safe, reliable throughput. The human element also undergoes a significant transition; developers and architects move "up the value chain," spending less time on manual execution and more on high-level judgment, verification, and exception management. Furthermore, the convergence of pro-code and low-code platforms requires CIOs to prioritize clear requirements, robust observability, and rigorous governance to avoid software sprawl. Ultimately, the goal is not just more generated code, but a redesigned delivery system where AI acts as a trusted coworker within a secure, governed framework, ensuring quality and resilience in increasingly complex software ecosystems.

Opinions on UK Online Safety Act emphasize importance of enforcement

The UK’s Online Safety Act (OSA) has sparked significant debate regarding its actual effectiveness in protecting children, as detailed in a recent report by Internet Matters. While the legislation has made safety tools and parental controls more visible, stakeholders argue that the lack of robust enforcement undermines its goals. Surveys indicate that children frequently encounter harmful content and find existing age verification methods easy to circumvent through tactics like using fake birthdays or VPNs. Despite these gaps, there is high public and youth support for safety features, such as improved reporting processes and restrictions on contacting strangers. However, the report highlights that the OSA fails to address primary parental concerns, specifically the excessive time children spend online and the emerging psychological risks posed by AI-generated content. Industry experts emphasize that while highly effective biometric technologies like facial age estimation and ID scanning exist, they must be consistently deployed to meet regulatory standards. Furthermore, critiques of the regulator Ofcom suggest its focus on corporate policies rather than specific content moderation may limit its impact. Ultimately, the consensus is that for the Online Safety Act to move beyond being a "leaky boat," the government must prioritize safety-by-design principles and hold both platforms and regulators accountable through rigorous leadership and enforcement.

They don’t hack, they borrow: How fraudsters target credit unions

The article "They don’t hack, they borrow" highlights a sophisticated shift in cybercrime where fraudsters exploit legitimate financial workflows rather than bypassing security systems. Instead of technical hacking, threat actors utilize highly structured methods to "borrow" funds through fraudulent loans, specifically targeting small to mid-sized credit unions. These institutions are preferred because they often rely on traditional verification methods and lack advanced behavioral fraud detection. The criminal process begins with acquiring stolen personal data and assessing a victim's credit profile to ensure high approval odds. Fraudsters then meticulously prepare for Knowledge-Based Authentication (KBA) by gathering details from leaked datasets and social media, effectively turning identity checks into predictable hurdles. Once an application is submitted under a stolen identity, the attacker navigates the lending process as a genuine customer. Upon approval, funds are rapidly moved through intermediary accounts to obscure their origin before being cashed out. By mirroring normal financial behavior, these organized schemes avoid triggering traditional security alarms. Researchers from Flare emphasize that this evolution from intrusion to process exploitation makes detection increasingly difficult, as the line between legitimate activity and fraud continues to blur, requiring institutions to adopt more adaptive, data-driven defense strategies to mitigate rising risks.

The Cloud Already Ate Your Hardware Lunch

The article "The Cloud Already Ate Your Hardware Lunch," published on BigDataWire on May 4, 2026, details a fundamental disruption in the enterprise technology market where cloud hyperscalers have effectively rendered traditional on-premises hardware procurement obsolete. Driven by a volatile combination of skyrocketing memory prices and severe supply chain shortages, modern organizations are finding it increasingly difficult to justify the costs of owning and maintaining independent data centers. The piece emphasizes that industry leaders like Microsoft, Google, and Amazon are allocating staggering capital—often exceeding $190 billion—to dominate the procurement of GPUs and high-bandwidth memory essential for generative AI. This aggressive consolidation has created a "hardware lunch" scenario, where cloud giants have successfully captured the market share once dominated by traditional server manufacturers. Enterprises are transitioning from viewing the cloud as an optional convenience to recognizing it as the only scalable platform for deploying AI agents and managing the massive datasets central to 2026 operations. Consequently, the legacy hardware model is being subsumed by advanced cloud ecosystems that offer superior integration, security, and raw power. This seismic shift marks the definitive conclusion of the on-premises era, as the sheer economic weight and technological advantages of the cloud become the only viable choice for remaining competitive in an AI-first economy.

One in four MCP servers opens AI agent security to code execution risk

The article examines the critical security risks inherent in enterprise AI agents, highlighting a significant "observability gap" between Model Context Protocol (MCP) servers and "Skills." While MCP servers offer structured, loggable functions, Skills load textual instructions directly into a model’s reasoning context, making their internal processes invisible to traditional monitoring tools. Research from Noma Security reveals that one in four MCP servers exposes agents to unauthorized code execution, while many Skills possess high-risk capabilities like data alteration. These vulnerabilities often manifest in "toxic combinations," where untrusted inputs and sensitive data access lead to sophisticated attacks such as ContextCrush or ForcedLeak. Even without malicious intent, autonomous agents have caused severe damage, exemplified by Replit's accidental database deletion. To address these blind spots, the "No Excessive CAP" framework is proposed, focusing on three defensive pillars: Capabilities, Autonomy, and Permissions. By strictly allowlisting tools, implementing human-in-the-loop approval gates for irreversible actions, and transitioning from broad service accounts to scoped, user-specific credentials, organizations can mitigate the risks of high-blast-radius incidents. Ultimately, because Skill-driven reasoning remains opaque, security teams must compensate by tightening control over the execution layer to prevent agents from operating with excessive, unsupervised authority.

The Shadow AI Governance Crisis: Why 80% of Fortune 500 Companies Have Already Lost Control of Their AI Infrastructure

The article "The Shadow AI Governance Crisis" by Deepak Gupta highlights a critical security gap where 80% of Fortune 500 companies have integrated autonomous AI agents into their infrastructure, yet only 10% possess a formal strategy to manage them. This "agentic shadow AI" differs from simple tool usage because these autonomous agents possess API access, chain actions across services, and operate at machine speed without human oversight. Traditional governance frameworks, designed for stable human identities, fail because AI agents are ephemeral and dynamic, leading to "identity without governance" and excessive permission sprawl. Statistics from Microsoft’s 2026 Cyber Pulse report underscore the urgency, noting that nearly 90% of organizations have already faced security incidents involving these agents. To combat this, the article introduces a five-capability framework centered on creating a centralized agent registry, implementing just-in-time access controls, and establishing real-time visualization of agent behaviors. High-profile breaches at McDonald’s and Replit serve as warnings of the catastrophic risks posed by unmonitored AI autonomy. Ultimately, Gupta argues that enterprises must shift from human-speed approval workflows to automated, runtime enforcement to maintain control. Building this foundational governance is presented as a necessary prerequisite for safe innovation and long-term competitive advantage in an increasingly AI-driven corporate landscape.

Daily Tech Digest - December 23, 2025

Quote for the day:

"What seems to us as bitter trials are often blessings in disguise." -- Oscar Wilde

The CIO Playbook: Reimagining Transformation in a Shifting Economy

The CIO has travelled from managing mainframes to managing meaning and purpose-driven transformation. And as AI becomes the nervous system of the enterprise, technology’s centre of gravity has shifted decisively to the boardroom. The basement may be gone, but its persona remains — a reminder that every evolution begins with resistance and is ultimately tamed by the quiet persistence of those who keep the systems running and the vision alive. Those who embraced progressive technology and blended business with innovation became leaders; the rest faded into also-rans. At the end of the day, the concern isn’t technology — it’s transformation capacity and the enterprise’s appetite to take risks, embrace change, and stay relevant. Organisations that lack this mindset will fail to evolve from traditional enterprises into intelligent, interactive digital ecosystems built for the AI age. The question remains: how do you paint the plane while flying it — and keep repainting it as customer needs, markets, and technologies shift mid-air? In this GenAI-driven era, the enterprise must think like software: in continuous integration, continuous delivery, and continuous learning. This isn’t about upgrading systems; it’s about rewiring strategy, culture, and leadership to respond in real time. We are at a defining inflection point. The time is now to connect the dots — to build an experience delivery matrix that not only works for your organisation but evolves with your customer.

Flexibility or Captivity? The Data Storage Decision Shaping Your AI Future

Enterprises today must walk a tightrope: on one side, harness the performance, trust, and synergies of long-standing storage vendor relationships; on the other, avoid entanglements that limit their ability to extract maximum value from their data, especially as AI makes rapid reuse of massive unstructured data sets a strategic necessity. ... Financial barriers also play a role. Opaque or punitive egress fees charged by many cloud providers can make it prohibitively expensive to move large volumes of data out of their environments. At the same time, workflows that depend on a vendor’s APIs, caching mechanisms, or specific interfaces can make even technically feasible migrations risky and disruptive. ... Budget and performance pressures add another layer of urgency. You can save tremendously by offloading cold data to lower-cost storage tiers. Yet if retrieving that data requires rehydration, metadata reconciliation, or funneling requests through proprietary gateways, the savings are quickly offset. Finally, the rapid evolution of technology means enterprises need flexibility to adopt new tools and services. Being locked into a single vendor makes it harder to pivot as the landscape changes. ... Longstanding vendor relationships often provide stability, support, and volume pricing discounts. Abandoning these partnerships entirely in the pursuit of perfect flexibility could undermine those benefits. The more pragmatic approach is to partner deeply while insisting on open standards and negotiating agreements that preserve data mobility.

Agentic AI already hinting at cybersecurity’s pending identity crisis

First, many of these efforts are effectively shadow IT, where a line of business (LOB) executive has authorized the proof of concept to see what these agents can do. In these cases, IT or cyber teams haven’t likely been involved, and so security hasn’t been a top priority for the POC. Second, many executives — including third-party business partners handling supply chain, distribution, or manufacturing — have historically cut corners for POCs because they are traditionally confined to sandboxes isolated from the enterprise’s live environments. But agentic systems don’t work that way. To test their capabilities, they typically need to be released into the general environment. The proper way to proceed is for every agent in your environment — whether IT authorized, LOB launched, or that of a third party — to be tracked and controlled by PKI identities from agentic authentication vendors. ... “Traditional authentication frameworks assume static identities and predictable request patterns. Autonomous agents create a new category of risk because they initiate actions independently, escalate behavior based on memory, and form new communication pathways on their own. The threat surface becomes dynamic, not static,” Khan says. “When agents update their own internal state, learn from prior interactions, or modify their role within a workflow, their identity from a security perspective changes over time. Most organizations are not prepared for agents whose capabilities and behavior evolve after authentication.”

Expanding Zero Trust to Critical Infrastructure: Meeting Evolving Threats and NERC CIP

StandardsPrevious compliance requirements have emphasized a perimeter defense model, leaving blind spots for any threats that happen to breach the perimeter. Zero Trust initiatives solve this by making accesses inside the perimeter visible and subjecting them to strong, identity-based policies. This proactive, Zero Trust-driven model naturally fulfills CIP-015-1 requirements, reducing or eliminating false positives compared to threat detection methods. In fact, an organization with a mature Zero Trust posture should be able to operate normally, even if the network is compromised. This resilience is possible when critical assets—such as controls in electrical substations or business software in the data center—are properly shielded from the shared network. Zero Trust enforces access based on verified identity, role, and context. Every connection is authenticated, authorized, encrypted, and logged. ... In short, Zero Trust’s identity-centric enforcement ensures that unauthorized network activity is detected and blocked. Even if a hacker has network access, they won’t be able to leverage that access to exfiltrate data or attack other hosts. A Zero Trust-protected organization can operate normally, even if the network is compromised. ... Zero Trust doesn’t replace your perimeter but instead reinforces it. Rather than replacing existing network firewalls, a Zero Trust can overlay existing security architectures, providing a comprehensive layer of defense through identity-based control and traffic visibility.

Top 5 enterprise tech priorities for 2026

The first is that the top priority, cited by 211 of the enterprises, is to “deploy the hardware, software, data, and network tools needed to optimize AI project value.” ... “You can’t totally immunize yourself against a massive cloud or Internet problem,” say planners. Most cloud outages, they note, resolve in a maximum of a few hours, so you can let some applications ride things out. When you know the “what,” you can look at the “how.” Is multi-cloud the best approach, or can you build out some capacity in the data center? ... “We have too many things to buy and to manage,” one planner said. “Too many sources, too many technologies.” Nobody thinks they can do some massive fork-lift restructuring (there’s no budget), but they do believe that current projects can be aligned to a long-term simplification strategy. This, interestingly, is seen by over a hundred of the group as reducing the number of vendors. They think that “lock-in” is a small price to pay for greater efficiency and reduction in operations complexity, integration, and fault isolation. ... The biggest problem, these enterprises say, is that governance has tended to be applied to projects at the planning level, meaning that absent major projects, governance tended to limp along based on aging reviews. Enterprises note that, like AI, orderly expansions in how applications and data are used can introduce governance issues, just like changes in laws and regulations.

Why flaky tests are increasing, and what you can do about it

One of the most persistent challenges is the lack of visibility into where flakiness originates. As build complexity rises, false positives or flaky tests often rise in tandem. In many organizations, CI remains a black box stitched together from multiple tools as artifact size increases. Failures may stem from unstable test code, misconfigured runners, dependency conflicts or resource contention, yet teams often lack the observability needed to pinpoint causes with confidence. Without clear visibility, debugging becomes guesswork and recurring failures become accepted as part of the process rather than issues to be resolved. The encouraging news is that high-performing teams are addressing this pattern directly. ... Better tooling alone will not solve the problem. organizations need to adopt a mindset that treats CI like production infrastructure. That means defining performance and reliability targets for test suites, setting alerts when flakiness rises above a threshold and reviewing pipeline health alongside feature metrics. It also means creating clear ownership over CI configuration and test stability so that flaky behaviour is not allowed to accumulate unchecked. ... Flaky tests may feel like a quality issue, but they are also a performance problem and a cultural one. They shape how developers perceive the reliability of their tools. They influence how quickly teams can ship. Most importantly, they determine whether CI/CD remains a source of confidence or becomes a source of drag.

Stop letting ‘urgent’ derail delivery. Manage interruptions proactively

As engineers and managers, we all have been interrupted by those unplanned, time-sensitive requests (or tasks) that arrive outside normal planning cadences. An “urgent” Slack, a last-minute requirement or an exec ask is enough to nuke your standard agile rituals. Apart from randomizing your sprint, it causes thrash for existing projects and leads to developer burnout. ... Existing team-level mechanisms like mid-sprint checkpoints provide teams the opportunity to “course correct”; however, many external randomizations arrive with an immediacy. ... Even well-triaged items can spiral into open-ended investigations and implementations that the team cannot afford. How do we manage that? Time-box it. Just a simple “we’ll execute for two days, then regroup” goes a long way in avoiding rabbit-holes. The randomization is for the team to manage, not for an individual. Teams should plan for handoffs as a normal part of supporting randomizations. Handoffs prevent bottlenecks, reduce burnout and keep the rest of the team moving. ... In cases where there are disagreements on priority, teams should not delay asking for leadership help. ... Without making it a heavy lift, teams should capture and periodically review health metrics. For our team, % unplanned work, interrupts per sprint, mean time to triage and periodic sentiment survey helped a lot. Teams should review these within their existing mechanisms (ex., sprint retrospectives) for trend analysis and adjustments.

How does Agentic AI enhance operational security

With Agentic AI, the deployment of automated security protocols becomes more contextual and responsive to immediate threats. The implementation of Agentic AI in cybersecurity environments involves continuous monitoring and assessment, ensuring that NHIs and their secrets remain fortified against evolving threats. ... Various industries have begun to recognize the strategic importance of integrating Agentic AI and NHI management into their security frameworks. Financial services, healthcare, travel, DevOps, and Security Operations Centers (SOC) have benefited from these technologies, especially those heavily reliant on cloud environments. In financial services, for instance, securing hybrid cloud environments is paramount to protecting sensitive client data. Healthcare institutions, with their vast troves of personal health information, have seen significant improvements in data protection through the use of these advanced cybersecurity measures. ... Agentic AI is reshaping how decisions are made in cybersecurity by offering algorithmic insights that enhance human judgment. Incorporating Agentic AI into cybersecurity operations provides the data-driven insights necessary for informed decision-making. Agentic AI’s capacity to process vast amounts of data at lightning speed means it can discern subtle signs of an impending threat long before a human analyst might notice. By providing detailed reports and forecasts, it offers decision-makers a 360-degree view of their security.

AI-fuelled cyber onslaught to hit critical systems by 2026

"Historically, operational technology cyber security incidents were the domain of nation states, or sometimes the act of a disgruntled insider. But recently, we've seen year-on-year rises in operational technology ransomware from criminal groups as well and with hacktivists: All major threat actor categories have bridged the IT-OT gap. With that comes a shift from highly targeted, strategic campaigns to the types of opportunistic attacks CISA describes. These are the predators targeting the slowest gazelles, so to speak," said Dankaart. ... Australian policymakers are expected to revise cybersecurity legislation and regulations for critical sectors. Morris added that organisations are looking at overseas case studies to reduce fraud and infrastructure-level attacks. ... "The scam ecosystem will continue to be exposed globally, raising new awareness of the many aspects of these crimes, including payment processors, geographic distribution of call centres and connected financial crimes. ... "The solution will be to find the 'Goldilocks Spot' of high automation and human accountability, where AI aggregates related tasks, alerts and presents them as a single decision point for a human to make. Humans then make one accountable, auditable policy decision rather than hundreds to thousands of potentially inconsistent individual choices; maintaining human oversight while still leveraging AI's capacity for comprehensive, consistent work."

Rising Tides: When Cybersecurity Becomes Personal – Inside the Work of an OSINT Investigator

The upside of all the technology and access we have is also what creates so much risk in the multitude of dangerous situations that Miller has seen and helped people out of in the most efficient and least disruptive ways possible. But, we as a cyber community have to help, but building ethics and integrity into our products so they can be used less maliciously in human cases; not simply data cases. ... When everything complicated is failing, go back to basics, and teach them over and over again, until the audience moves forward. I’ve spent a decade doing this and still share the same basic principles and safety measures. Technology changes, so do people, but sometimes the things they need the most are to to be seen, heard and understood. This job is a lot of emotional support and working through the things where the client gets hung up making a decision, or moving forward. ... The amount of energy and time devoted to cases has to have a balance. I say no to more cases than I say yes, simply because I don’t have the resources or time to do them. ... As the world changes, you have to adapt and shift your tactics, delivery, and capabilities to help more people. While people like to tussle over politics, I remind them, everything is political. It’s no different in community care, mutual aid, or non-profit work. If systems cannot or won’t support communities, you have a responsibility to help build parallel systems of care that can. This means not leaving anyone behind, not sacrificing one group over another.

Daily Tech Digest - November 21, 2025

Quote for the day:

“You live longer once you realize that any time spent being unhappy is wasted.” -- Ruth E. Renkl

DPDP Rules and the Future of Child Data Safety

Most obligations for , including verifiable parental consent, security safeguards, breach notifications, data minimisation, and processing restrictions for children’s data, come into force after 18 months. This means that although the law recognises children’s rights today, full legal protection will not be enforceable until the culmination of the 18-month window. ... Parents’ awareness of data rights, online safety, and responsible technology is the backbone of their informed participation. The government needs to undertake a nationwide with the help of , modelled on literacy and health awareness drives. ... schools often outsource digital functions to vendors without due diligence. Over the next 18 months, they must map where the student data is collected and where it flows, renegotiate contracts with vendors, ensure secure data storage, and train teachers to spot data risks. Nationwide teacher-training programmes should embed digital pedagogy, data privacy, and ethical use of technology as core competencies. ... effective implementation will be contingent on the autonomy, resourcefulness, and accessibility of the . The regulator should include specialised talent such as and privacy engineers. It should be supported by building an in-house digital forensics unit, capable of investigating leaks, tracing unauthorised access, and examining algorithmic profiling.

5 best practices for small and medium businesses (SMEs) to strengthen cybersecurity

First, begin with good access control which would entail restricting employees to only the permissions that they specifically require. It is also important to have multi-factor authentication in place, and regularly audit user accounts, particularly when roles shift or personnel depart. Second, keep systems and software current by immediately patching operating systems, applications, and security software to close vulnerabilities before they can be exploited by attackers. Similarly, updates should be automated to avoid human error. The staff are usually at the front line of the defence, so the third essential practice is the continuous ongoing training of employees in identifying , suspicious links, and social engineering methods, making them active guardians of corporate data and effectively cutting the risk of a . Fourth is the safeguarding your data which can be implemented by having regular backups stored safely in multiple places and by complementing them with an explicit disaster recovery strategy, so that you are able to restore operations promptly, reduce downtime, and constrain losses in the event of a cyber attack. Fifth and finally, companies should embrace the layered security paradigm using antivirus tools, firewalls, endpoint protection, encryption, and safe networks. Each of those layers complement each other, creating a resilient defence that protects your digital ecosystem and strengthens trust with partners, customers, and stakeholders.

How Artificial Intelligence is Reshaping the Software Development Life Cycle (SDLC)

With , workflows become faster and more efficient, giving engineers more time to concentrate on creative innovation and tackling complex challenges. As these models advance, they can better grasp context, learn from previous projects, and adapt to evolving needs. ... AI streamlines software design by speeding up prototyping, automating routine tasks, optimizing with predictive analytics, and strengthening security. It generates design options, translates business goals into technical requirements, and uses fitness functions to keep code aligned with architecture. This allows architects to prioritize strategic innovation and boosts development quality and efficiency. ... AI is shifting developers’ roles from manual coding to strategic "code orchestration." Critical thinking, business insight, and ethical decision-making remain vital. AI can manage routine tasks, but human validation is necessary for security, quality, and goal alignment. Developers skilled in AI tools will be highly sought after. ... AI serves to augment, not replace, the contributions of human engineers by managing extensive data processing and pattern recognition tasks. The synergy between AI's computational proficiency and human analytical judgment results in outcomes that are both more precise and actionable. Engineers are thus empowered to concentrate on interpreting AI-generated insights and implementing informed decisions, as opposed to conducting manual data analysis.

Innovative Approaches To Addressing The Cybersecurity Skills Gap

In a talent-constrained world, forward-leaning organizations aren’t hiring more analysts—they’re deploying agentic AI to generate continuous, cryptographic proof that controls worked when it mattered. This defensible automation reduces breach impact, insurer friction and boardroom risk—no headcount required. ... Create an architecture and engineering review board (AERB) that all current and future technical designs are required to flow through. Make sure the AERB comprises a small group of your best engineers, developers, network engineers and security experts. The group should meet multiple times a year, and all technical staff should be required to rotate through to listen and contribute to the AERB. ... Build security into product design instead of adding it in afterward. Embed industry best practices through predefined controls and policy templates that enforce protection automatically—then partner with trusted experts who can extend that foundation with deep, domain-specific insight. Together, these strategies turn scarce talent into amplified capability. ... Rather than chasing scarce talent, companies should focus on visibility and context. Most breaches stem from unknown identities and unchecked access, not . By strengthening identity governance and access intelligence, organizations can multiply the impact of small security teams, turning knowledge, not headcount, into their greatest defense.

The Configurable Bank: Low‑Code, AI, and Personalization at Scale

What does the present day modern banking system look like: The answer depends on where you stand. For customers, need to be instant, invisible, and intuitive – a seamless tap, a scan, a click. For banks, it’s an ever-evolving race to keep pace with rising expectations. ... What was once a luxury i.e. speed and dependability – has become the standard. Yet, behind the sleek mobile apps and fast payments, many banks are still anchored to quarterly release cycles and manual processes that slow innovation. To thrive in this landscape, banks don’t need to rip out their core systems. What they need is configurability – the ability to re-engineer services to be more agile, composable, and responsive. By making their systems configurable rather than fixed, banks can launch products faster, adapt policies in real time, and reduce the cost and complexity of change. ... The idea of the Configurable Bank is built on this shift – where technology, powered by and AI, transforms banking into a living, adaptive platform. One that learns, evolves, and personalizes at scale – not by replacing the core, but by reimagining how it connects with everything around it. ... This is not just a technology shift; it’s a strategic one. With low-code, innovation is no longer the privilege of IT alone. Business teams, product leaders, and even customer-facing units can now shape and deploy digital experiences in near real time.

Deepfake crisis gets dire prompting new investment, calls for regulation

, Doppel’s CEO, says that organizations are not prepared for the flood of AI-generated deception coming at them. “Over the past few months, what’s gotten significantly better is the ability to do real-time, synchronous in an intelligent manner. I can chat with my own deepfake in real-time. It’s not scripted, it’s dynamic.” Tian tells Fortune that Doppel’s mission is not to stamp out , but “to stop social engineering attacks, and the malicious use of deepfakes, traditional impersonations, copycatting, fraud, phishing – you name it.” The firm says its R&D team has “just scratched the surface” of innovations it plans to bring to existing and upcoming products, notably in (SED). The Series C funds will “be used to invest in the core Doppel gang to meet the exponential surge in demand.” ... Advocating for “laws that prioritize human dignity and protect democracy,” the piece points to the EU’s AI Act and as models, and specifically to new copyright legislation in Denmark, which bans the creation of deepfakes without a subject’s consent. In the authors’ words, Denmark’s law would “legally enshrine the principle that you own you.” ... “The rise of deepfake technology has shown that voluntary policies have failed; companies will not police themselves until it becomes too expensive not to do so,” says the piece.

The what, why and how of agentic AI for supply chain management

To be sure, software and automation are nothing new in the supply chain space. Businesses have long used digital tools to help track inventories, manage fleet schedules and so on as a way of boosting efficiency and scalability. Agentic AI, however, goes further than traditional SCM software tools, offering capabilities that conventional systems lack. For instance, because agents are guided by AI models, they are capable of identifying novel solutions to challenges they encounter. can’t do this because they rely on pre-scripted options and don’t know what to do when they encounter a scenario no one envisioned beforehand. AI can also automate multiple, interdependent SCM processes, as I mentioned above. Traditional SCM tools don’t usually do this; they tend to focus on singular tasks that, although they may involve multiple steps, are challenging to automate fully because conventional tools can’t reason their way through unforeseen variables in the way AI agents do. ... Deploying agents directly into production is enormously risky because it can be challenging to predict what they’ll do. Instead, begin with a proof of concept and use it to validate agent features and reliability. Don’t let agents touch production systems until you’re deeply confident in their abilities. ... For high-stakes or particularly complex workflows, it’s often wise to keep a human in the loop.

How AI can magnify your tech debt - and 4 ways to avoid that trap

The survey, conducted in September, involved 123 executives and managers from large companies. There are high hopes that AI will help cut into and clear up issues, along with cost reduction. At least 80% expect productivity gains, and 55% anticipate AI will help reduce technical debt. However, the large segment expecting AI to increase technical debt reflects "real anxiety about security, legacy integration, and black-box behavior as AI scales across the stack," the researchers indicated. Top concerns include security vulnerabilities (59%), legacy integration complexity (50%), and loss of visibility (42%). ... "Technical debt exists at many different levels of the technology stack," Gary Hoberman, CEO of Unqork, told ZDNET. "You can have the best 10X engineer or the best AI model writing the most beautiful, efficient code ever seen, but that code could still be running on runtimes that are themselves filled with technical debt and security issues. Or they may also be relying on open-source libraries that are no longer supported." ... AI presents a new raft of problems to the tech debt challenge. The rising use of AI-assisted code risks "unintended consequences, such as runaway maintenance costs and increasing tech debt," Hoberman continued. IT is already overwhelmed with current system maintenance.

The State and Current Viability of Real-Time Analytics

Data managers now prefer real-time analytical capabilities built within their applications and systems, rather than a separate, standalone, or bolted-on project. Interest in real-time analytics as a standalone effort has dropped from 50% to 32% during the past 2 years, a recent survey of 259 data managers conducted by Unisphere Research finds ... So, the question becomes: Are real-time analytics ubiquitous to the point in which they are automatically integrated into any and all applications? By now, the use of real-time analytics should be a “standard operating requirement” for customer experience, said , founder and CTO at Aerospike. This is where the rubber meets the road—where “the majority of the advances in real-time applications have been made in consumer-oriented enterprises,” he added. Along these lines, the most prominent use cases for real-time analytics include “risk analysis, fraud detection, recommendation engines, user-based dynamic pricing, dynamic billing and charging, and customer 360,” Srinivasan continued. “For over a decade, these systems have been using AI and machine learning [ML], inferencing for improving the quality of real-time decisions to improve customer experience at scale. The goal is to ensure that the first customer and the hundred-millionth customer have the same vitality of customer experience.” ... “Within industries such as energy, life sciences, and chemicals, the next decade of real-time analytics will be driven by more autonomous operations,” said David Streit

You Down with EDD? Making Sense of LLMs Through Evaluations

We're facing a major infrastructure maturity gap in AI development — the same gap the software world faced decades ago when applications grew too complex for informal testing and crossed fingers. Shipping fast with user feedback works early on, but when done at scale with rising stakes, "vibes" break down and developers demand structure, predictability, and confidence in their deployments. ... AI engineering teams are turning to an emerging solution: evaluation-driven development (EDD), the probabilistic cousin to TDD. An evaluation looks similar to a traditional software test. You have an assertion, a response, and pass-fail criteria, but instead of asking "Does this function return 42?" you're asking "Does this legal AI application correctly flag the three highest-risk clauses in this nightmare of a merger agreement?" Our trust in AI systems comes from our trust in the evaluations themselves, and if you never see an evaluation fail, you're not testing the right behaviors. The practice of Evaluation-Driven Development (EDD) is about repeatedly testing these evaluations. ... The technology for EDD is ready. Modern AI platforms provide solid evaluation frameworks that integrate with existing development workflows, but the challenge facing wide adoption is cultural. Teams need to embrace the discipline of writing evaluations before changing systems, just like they learned to write tests before shipping code. It requires a mindset shift from "move fast and break things," to "move deliberately and measure everything."